Standard library for AES encryption for VB.NET?

Question

Is there a standard library for AES encryption for VB.NET? I want to encrypt a string with a static private key.

I googled and found many variations. I do not know how to determine which algorithms are safe or not.

Answer 1

The System.Security.Cryptography contains all the classes needed to perform most standard encryption tasks. Unfortunately, since encryption is a rather complicated topic, it is difficult to work with some classes - especially for beginners. Sometimes it is difficult to find a simple working example. But since I'm cute, I will provide you with a simple example with which you can play and improve :)

The class you probably want to use is called RijndaelManaged . This is a class that implements typical AES encryption. Here's a sample class that uses this to convert between simple text strings and byte arrays:

 Public Class Aes256Encrypter Public Function Encrypt(ByVal plainText As String, ByVal secretKey As String) As Byte() Dim encryptedPassword As Byte() Using outputStream As MemoryStream = New MemoryStream() Dim algorithm As RijndaelManaged = getAlgorithm(secretKey) Using cryptoStream As CryptoStream = New CryptoStream(outputStream, algorithm.CreateEncryptor(), CryptoStreamMode.Write) Dim inputBuffer() As Byte = Encoding.Unicode.GetBytes(plainText) cryptoStream.Write(inputBuffer, 0, inputBuffer.Length) cryptoStream.FlushFinalBlock() encryptedPassword = outputStream.ToArray() End Using End Using Return encryptedPassword End Function Public Function Decrypt(ByVal encryptedBytes As Byte(), ByVal secretKey As String) As String Dim plainText As String = Nothing Using inputStream As MemoryStream = New MemoryStream(encryptedBytes) Dim algorithm As RijndaelManaged = getAlgorithm(secretKey) Using cryptoStream As CryptoStream = New CryptoStream(inputStream, algorithm.CreateDecryptor(), CryptoStreamMode.Read) Dim outputBuffer(0 To CType(inputStream.Length - 1, Integer)) As Byte Dim readBytes As Integer = cryptoStream.Read(outputBuffer, 0, CType(inputStream.Length, Integer)) plainText = Encoding.Unicode.GetString(outputBuffer, 0, readBytes) End Using End Using Return plainText End Function Private Function getAlgorithm(ByVal secretKey As String) As RijndaelManaged Const salt As String = "put your salt here" Const keySize As Integer = 256 Dim keyBuilder As Rfc2898DeriveBytes = New Rfc2898DeriveBytes(secretKey, Encoding.Unicode.GetBytes(salt)) Dim algorithm As RijndaelManaged = New RijndaelManaged() algorithm.KeySize = keySize algorithm.IV = keyBuilder.GetBytes(CType(algorithm.BlockSize / 8, Integer)) algorithm.Key = keyBuilder.GetBytes(CType(algorithm.KeySize / 8, Integer)) algorithm.Padding = PaddingMode.PKCS7 Return algorithm End Function End Class 

You must change the salt constant to something else. Ideally, it would not even be permanent, because in order to make it as secure as possible, you should use a different salt every time you perform encryption, but this is a whole different topic.

If you want the encrypted value to be returned as a string instead of a byte array, you can use Base-64 encoding to convert the byte array to and from strings as follows:

 Public Class Aes256Base64Encrypter Public Function Encrypt(ByVal plainText As String, ByVal secretKey As String) As String Dim encryptedPassword As String = Nothing Using outputStream As MemoryStream = New MemoryStream() Dim algorithm As RijndaelManaged = getAlgorithm(secretKey) Using cryptoStream As CryptoStream = New CryptoStream(outputStream, algorithm.CreateEncryptor(), CryptoStreamMode.Write) Dim inputBuffer() As Byte = Encoding.Unicode.GetBytes(plainText) cryptoStream.Write(inputBuffer, 0, inputBuffer.Length) cryptoStream.FlushFinalBlock() encryptedPassword = Convert.ToBase64String(outputStream.ToArray()) End Using End Using Return encryptedPassword End Function Public Function Decrypt(ByVal encryptedBytes As String, ByVal secretKey As String) As String Dim plainText As String = Nothing Using inputStream As MemoryStream = New MemoryStream(Convert.FromBase64String(encryptedBytes)) Dim algorithm As RijndaelManaged = getAlgorithm(secretKey) Using cryptoStream As CryptoStream = New CryptoStream(inputStream, algorithm.CreateDecryptor(), CryptoStreamMode.Read) Dim outputBuffer(0 To CType(inputStream.Length - 1, Integer)) As Byte Dim readBytes As Integer = cryptoStream.Read(outputBuffer, 0, CType(inputStream.Length, Integer)) plainText = Encoding.Unicode.GetString(outputBuffer, 0, readBytes) End Using End Using Return plainText End Function Private Function getAlgorithm(ByVal secretKey As String) As RijndaelManaged Const salt As String = "put your salt here" Const keySize As Integer = 256 Dim keyBuilder As Rfc2898DeriveBytes = New Rfc2898DeriveBytes(secretKey, Encoding.Unicode.GetBytes(salt)) Dim algorithm As RijndaelManaged = New RijndaelManaged() algorithm.KeySize = keySize algorithm.IV = keyBuilder.GetBytes(CType(algorithm.BlockSize / 8, Integer)) algorithm.Key = keyBuilder.GetBytes(CType(algorithm.KeySize / 8, Integer)) algorithm.Padding = PaddingMode.PKCS7 Return algorithm End Function End Class 

If you store the encrypted value in a text file, XML file, or even a database, it is often easier to just use Base-64, for example.

Answer 2

There are high-level encryption libraries that handle the fine details of encryption, so you are not making these errors, Keyczar , Nacl , GPGME .

I put Keyczar in .net and uses AES for its symmetric encryption by default.

You are using a command line program to create a keyset with a random AES key.

 :> KeyczarTool.exe create --location=path_to_key_set --purpose=crypt :> KeyczarTool.exe addkey --location=path_to_key_set --status=primary 

In your project for encryption

 Using encrypter As New Encrypter("path_to_key_set") Return encrypter.Encrypt(plaintext) End Using 

And then decrypt

 Using crypter As new Crypter("path_to_key_set") Return crypter.Decrypt(ciphertext) End Using